Deep Agents Code now offers an opt-in **Auto** approval mode. Auto
immediately runs a narrow, deterministic set of routine actions. For
other approval-gated actions, the active model checks whether they match
the user's literal request. It runs approved actions and blocks the
rest. After repeated denials or classifier failures, Auto sends the next
batch to the normal approval UI, then continues in Auto mode.
Auto is experimental and currently limited to interactive, local TUI
sessions using `FilesystemBackend`. Manual remains the default.
> [!WARNING]
> Auto is an authorization heuristic for a local coding agent. It is
**not** sandbox containment, an operating-system boundary, or a
guarantee that model-generated actions are safe.
## Enable Auto
1. Set `DEEPAGENTS_CODE_EXPERIMENTAL=1`.
2. Select Auto in one of these ways:
- In-app: use <kbd>Shift</kbd>+<kbd>Tab</kbd> or
<kbd>Ctrl</kbd>+<kbd>T</kbd> to toggle between Manual and Auto.
- At launch: pass `-y` or `--auto-approve`.
- By default: set `[startup].mode = "auto"` in
`~/.deepagents/config.toml`.
`-y` and `--auto-approve` now select Auto rather than unrestricted
execution. Users who want the previous unrestricted behavior must choose
`--yolo`. The removed `dangerously-auto` startup value is no longer
recognized and falls back to Manual.
---
## Why
The previous approval modes forced a binary choice:
- **Manual** preserved a human checkpoint, but repeatedly interrupted
routine coding work.
- **YOLO** removed that checkpoint entirely, including for actions that
exceeded the user's request (blanket approval).
Auto introduces a third policy: keep the low-friction path for clearly
routine work, but make authorization explicit for potentially
consequential actions.
| Mode | Policy | Entry points | Availability |
|---|---|---|---|
| **Manual** | Uses the normal human approval UI for gated actions |
Default; `[startup].mode = "manual"` | All interactive sessions |
| **Auto** | Uses narrow deterministic rules, then classifier review,
with human fallback after repeated denials or failures | `-y`,
`--auto-approve`, `[startup].mode = "auto"`, or the live keyboard toggle
| Experimental, local, unsandboxed TUI sessions |
| **YOLO** | Runs gated actions without review | `--yolo` or
`[startup].mode = "yolo"` | Interactive sessions after a one-time
acknowledgement |
## How Auto handles a proposed action
```mermaid
flowchart TD
A[Model proposes tool calls] --> B{Covered by the approval policy?}
B -->|No| X[Existing tool behavior is unchanged]
B -->|Yes| S{Is this thread still in Auto, with readable denial/failure history?}
S -->|No| J[Open the existing approval HITL widget]
S -->|Yes| C{Narrow deterministic allow?}
C -->|Yes| R[Execute without a classifier call]
C -->|No| D[Build one structured decision batch]
D --> H{Was this batch already reviewed, or do earlier denials/failures require human review?}
H -->|Yes| J
H -->|No| E[Active model reviews effects against user request/input]
E -->|Allow| R
E -->|Deny| Q{Total-denial threshold reached?}
Q -->|No| F[Return a sanitized error result]
Q -->|Yes| J
E -->|Unavailable or invalid| G[Return a compact unavailable result]
F --> I[Agent can revise its plan]
G --> I
J -->|Approve| R
J -->|Reject| K[Return a rejection result]
J -->|Switch to Manual| L[Persist Manual, then review the full gated batch]
R --> M[Reconcile the result and continue]
K --> M
I --> M
L --> M
```
In practice:
1. **Auto starts with Manual's existing human-in-the-loop (HITL)
rules.** It changes only how HITL-gated actions are reviewed.
- These built-in tools are not HITL-gated: `ls`, `read_file`, `glob`,
`grep`, `ask_user`, `get_goal`, `get_rubric`, and `update_goal`.
- MCP tools with valid read-only annotations, the optional `js_eval`
tool, and caller-supplied tools without HITL configuration continue to
run normally.
2. **Only narrow cases resolve locally.** The deterministic policy can
allow, never deny:
- A routine write such as `src/parser.py` can proceed based on its
resolved path and suffix; a sensitive target such as
`.github/workflows/ci.yml` goes to classifier review.
- A read-only Git command such as `git status` can proceed; a mutating
command such as `git commit -m change` goes to classifier review.
Explicit shell allow-list entries still apply after Auto removes broad
and wildcard rules.
- An MCP tool with a valid read-only annotation can proceed; tools
without read-only annotations, or with contradictory or malformed
annotations, go to classifier review.
<details>
<summary>How MCP read-only annotations are evaluated</summary>
MCP servers can attach standard `ToolAnnotations` when advertising a
tool. Deep Agents Code copies those annotations into the wrapped tool's
metadata and lets the tool bypass classifier review only when:
- `readOnlyHint` is the literal Boolean `true`;
- `destructiveHint` is absent, `null`, or `false`; and
- every supplied standard hint (`readOnlyHint`, `destructiveHint`,
`idempotentHint`, or `openWorldHint`) is a Boolean or `null`, rather
than a string or another type.
For example:
- `readOnlyHint: true, destructiveHint: false` proceeds without
classifier review.
- No `readOnlyHint` goes to review because the tool never explicitly
claimed to be read-only.
- `readOnlyHint: true, destructiveHint: true` goes to review because the
hints contradict each other.
- `readOnlyHint: true, destructiveHint: "false"` goes to review because
`"false"` is a string, not a Boolean.
In Auto, tools that do not pass this check enter the classifier batch.
In Manual, they use the normal approval UI; headless runtimes reject
them because they have no approval UI. The annotation is a
server-provided assertion that Deep Agents Code does not independently
verify.
</details>
3. **The classifier reviews all unresolved calls together.** Only
pre-expansion literal user text can authorize an action. Referenced
paths, summarized arguments, prior tool calls, and MCP metadata provide
effect context but cannot grant permission. Expanded files, assistant
prose, and tool results are excluded.
- **Example:** For the literal request `Research issue #123, update
@src/parser.py, and open a PR`, proposed `fetch_url` and `git push`
calls can be reviewed in one batch and receive separate decisions. The
referenced path and summarized call arguments help identify what each
action would affect, but the expanded file contents are not sent.
Instructions found in that file, assistant prose, or a prior tool result
therefore cannot widen the user's request or authorize another action.
4. **Auto revalidates before side effects.** The decision plan is bound
to the thread, mode, batch, and exact gated calls. Missing or invalid
state, a mode race, or a replay falls back to human review. Denied calls
are skipped and receive sanitized error results so the agent can revise
its plan.
- **Examples:** If the user switches to Manual while classifier review
is in progress, an earlier Auto decision cannot execute silently; the
normal approval UI opens instead. A plan associated with another thread,
a different set of tool-call IDs, missing decisions, or a previously
processed batch also requires human review. If Auto denies a proposed
`delete`, it returns an error result with that call's ID instead of
invoking the tool, allowing the agent to propose a safer next step.
## Limits and user-visible behavior
- The Manual approval menu can enable Auto for the current thread.
Threshold fallback can switch permanently to Manual or perform a one-off
review while leaving Auto enabled.
- Denials, classifier failures, and fallbacks appear as short sanitized
transcript events rather than raw classifier output.
- Auto requested without the experimental opt-in, or in a sandboxed
session, falls back to Manual with a warning. Explicit autonomous-mode
flags are rejected in non-interactive and ACP entry points.
- The active model is not an independent security authority. MCP
read-only annotations are trusted as a deliberate beta tradeoff.
- Parent-level Auto review does not cover actions performed inside
delegated subagents or broader explicitly configured PTC/`js_eval`
fan-out. Model providers and tracing backends may still observe
classifier inputs and outputs even though the TUI hides them.
<details>
<summary><strong>Implementation and reviewer details</strong></summary>
### Approval boundary and decision inputs
The following tools are HITL-gated:
- `execute`, `write_file`, `edit_file`, and `delete`;
- `web_search` and `fetch_url`;
- `task`;
- `start_async_task`, `update_async_task`, and `cancel_async_task`;
- `compact_conversation` when optional compaction approval is enabled;
and
- MCP tools without valid read-only annotations.
For deterministic writes and edits, the fast path uses only the resolved
target path and suffix; it does not inspect proposed content. Dependency
and lock files, sensitive names and locations, shell scripts,
unsupported file types, and paths outside the trusted root do not
qualify. Selected Git inspection commands must also pass shell-control
and outside-worktree path checks. Configured shell entries remain an
explicit user trust exception, but broad commands and wildcard entries
are ignored by Auto.
The classifier receives one typed batch containing:
- up to 20 client-attached, pre-expansion prompt rows, including literal
prompts, referenced path names, and turn IDs;
- trusted project-root and redacted-origin facts; and
- depth- and length-limited effect context from current arguments, prior
AI tool calls after the latest trusted prompt, and selected MCP
annotations.
Only `literal_user_text` is authorizing. Content-bearing write/edit
arguments are reduced to character counts. The classifier must return
exactly one unique decision for every unresolved tool-call ID; missing,
duplicated, unknown, or malformed decisions make the classifier
unavailable rather than partially authorizing the batch.
Before routing calls, Auto re-reads the live mode and validates its
private decision plan. Manual mode, invalid control state, mismatched
calls, or replayed batches require human review. Classifier review uses
a second call to the active session model with a 20-second timeout. Raw
classifier text and tool-call chunks are hidden from the transcript,
while usage accounting and tracing are retained.
Denial reasons are sanitized before persistence or display by removing
control characters, known credential values, credential-like
assignments, and URL credentials or query values. MCP tools without
valid read-only annotations are HITL-gated; headless runtimes reject
them because no approval UI is available.
### Failure and fallback behavior
| Condition | Result |
|---|---|
| Selected mode cannot be persisted | Persist Manual instead; if that
also fails, block graph execution |
| Classifier timeout, provider error, or invalid response | Block the
affected calls and return a compact unavailable result |
| Three consecutive policy denials in one user turn | Send the next
classifier-review-eligible calls to one-off human review |
| Two consecutive classifier-unavailable results | Send the next
classifier-review-eligible calls to one-off human review |
| A denial raises the thread's total denial count to 20 | Require human
review for that call immediately |
| Counter state cannot be read or reset before classification | Require
human review for every gated call in the batch |
| Counter state cannot be written after classification | Require human
review for classifier-path decisions; deterministic fast-path allows
remain eligible |
| Decision plan is missing, malformed, replayed, or bound to another
thread | Require Manual review |
| User chooses **Switch to Manual** during fallback | Persist Manual
before presenting the full gated batch for review |
### Python API and state compatibility
- Existing Boolean compatibility input retains its previous meaning:
`auto_approve=True` maps to YOLO, not Auto.
- Per-thread Store records persist the typed mode instead of a Boolean.
Missing, legacy, or malformed records fail closed.
- Startup and live mode changes take effect only after the Store write
succeeds.
- YOLO requires a versioned local acknowledgement and cannot be entered
through the live keyboard toggle.
### Reviewer guide
Suggested review order:
1. **Mode semantics and persistence** — `ApprovalMode`, Store payloads,
acknowledgement, startup resolution, and live mode writes.
2. **Authorization policy** — `AutoModeHITLMiddleware`, literal prompt
metadata, deterministic routing, structured classification,
sanitization, counters, and checkpoint validation.
3. **Graph boundary** — middleware replacement, the gated-tool
inventory, MCP annotation handling, headless rejection, PTC, and
delegated-subagent scope.
4. **Client behavior** — stream metadata, classifier-output filtering,
fallback interrupts, keyboard toggles, status presentation, and
transcript events.
Highest-risk invariants:
- every consequential tool in the supported boundary is gated or
explicitly outside scope;
- path-based writes and selected Git fast paths stay within their
documented checks;
- only literal user prompts can authorize classifier-reviewed effects;
- malformed output, Store failures, mode races, and checkpoint replay
fail closed; and
- hidden classifier chunks never create transcript content while usage
accounting remains intact.
</details>
When quitting waits for unfinished work, `deepagents-code` now shows a
brief "Finishing pending work before exit…" toast so the pause reads as
intentional rather than a hang.
---
`DeepAgentsApp.exit()` only defers teardown when it must wait for an
in-flight agent worker or pending fire-and-forget hooks. That wait was
previously silent, so a user pressing quit could think the app had
frozen. This adds a single toast on exactly that deferred path.
The notification is emitted before scheduling the `_graceful_exit`
coroutine. Because scheduling returns control to the event loop and
teardown is deferred behind at least one `await`, Textual's message pump
gets an opportunity to render the toast before `super().exit()` runs.
Immediate/idle exits skip this branch entirely, no delay is introduced,
and the existing two-second grace period is untouched. A repeated/forced
exit hits the existing force-quit guard before reaching the notify, so
the toast is never duplicated (including when both wait conditions
apply).
Made by [Open
SWE](https://openswe.vercel.app/agents/26e6d24a-3180-4334-b655-4075767ae45b)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
`dcode config list`/`dcode config ls` are removed; use `dcode config
show` (add `--verbose` to see all option keys).
---
`config list`/`config ls` duplicated `config show`, so this removes both
parser aliases and makes `config show` the sole command for displaying
effective config values and their sources. Drops `list_mode`, the
`config list` JSON label/catalog special-casing, backward-compat
comments, and now-dead paths; `config show --json` keeps effective-only
fields (catalog folded in only with `--verbose`) and always labels the
payload `"config show"`. User-facing suggestions now point at `config
show`/`config show --verbose`. Backward compatibility is intentionally
not preserved.
### Breaking change
`config list --json` was the machine-readable catalog endpoint (its JSON
envelope `command` field was `"config list"` and it always folded in
catalog fields). It is gone: the command no longer parses, and the
catalog fields are now available via `config show --verbose --json`
(payload labeled `"config show"`). Any machine consumer of `config list
--json` must migrate.
Made by [Open
SWE](https://openswe.vercel.app/agents/7351f382-9468-b4dc-2df4-03eaf75ef12f)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Typing in the chat input is no longer blocked while the `/restart`
command respawns the server.
---
Running `/restart` froze the chat input until the server finished
respawning. `_handle_restart_command` awaited the multi-second
`_restart_server_manual` (`server_proc.restart()`) directly on the
Textual message pump, so key events stopped being forwarded and the chat
input was "blocked". This is the same class of bug fixed for the MCP
viewer `Ctrl+R` reconnect path in #4753 — the fix runs the respawn as a
detached `asyncio.create_task` (mirroring the MCP viewer/force-reconnect
paths), keeping the pump free so keystrokes stay live and queued
messages drain once `ServerReady` fires.
Made by [Open
SWE](https://openswe.vercel.app/agents/a27e2ef4-b392-c236-f410-c1b9ebc533aa)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Editable installs conflated three distinct version facts, so `/version`,
`--version`, and `doctor` could silently report a single number that hid
stale metadata or a broken SDK dependency pin. Version diagnostics now
separate the live source version, the installed distribution metadata
version, and the `deepagents` requirement that `deepagents-code`
declares — reporting the source version as primary for editable
installs, showing the installed metadata alongside it when they drift,
and flagging an actionable mismatch when the installed SDK metadata does
not satisfy the declared requirement.
---
A new structured `DistributionVersion`/`VersionReport` representation in
`extras_info` is the single source of truth these surfaces render.
`resolve_sdk_version()` is preserved as a thin compatibility wrapper so
existing callers are untouched.
- `/version`, `--version`, and `doctor` render the same facts: an
editable SDK is now clearly identified (not just editable
`deepagents-code`), source/metadata drift shows both versions, and an
unsatisfied requirement (compared via `packaging.Requirement`) is
surfaced as `required by deepagents-code: <version> — mismatch`.
- `doctor` marks a dependency-requirement mismatch unhealthy, while
treating source/metadata drift as informational since it is normal while
editing SDK source.
- Normal non-editable output is unchanged when all versions agree, and
version collection stays fully offline and best-effort (no
`uv`/`pip`/PyPI, no subprocess).
- No package versions or dependency pins were changed.
Two existing `doctor` integration tests now isolate the SDK requirement
check so they stay deterministic regardless of the workspace's
intentional prerelease pin; the mismatch and drift paths have dedicated
new coverage.
Made by [Open
SWE](https://openswe.vercel.app/agents/1145d1a5-ba8a-abbb-e5b7-039e9c2a5b04)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Fixed dcode TUI `task` elapsed timers resetting when a nested subagent
reached a human-in-the-loop approval checkpoint.
---
A long-running `task [general-purpose]` row's elapsed timer reset to
zero whenever a nested subagent hit a HITL approval checkpoint. The
interrupt handler paused/resumed *every* tracked tool row, and
`ToolCallMessage.pause_running()`/`set_running()` clear and reassign
`_start_time` — so an unrelated nested child's (or sibling subagent's)
approval restarted the outer `task` timers. This scopes pause/resume to
only the rows an interrupt actually owns (matched by tool name + args
via the new `_interrupt_owned_tool_rows` helper). Untracked nested-child
interrupts now own no outer row, so outer and sibling `task` timers stay
monotonic and completed `Took …` durations reflect full execution time.
A tool awaiting its own initial approval still pauses then resumes as
before.
Made by [Open
SWE](https://openswe.vercel.app/agents/5c0ae962-c16b-6e04-ada4-d4d76826adb9)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
The `/version` command's update-available line hard-coded `uv tool
install -U deepagents-code`, which is stale guidance now that dcode
auto-updates on relaunch and offers `/update` and `dcode update`. It now
points at the relaunch/auto-update path when auto-update is enabled, and
at `/update` or `dcode update` otherwise.
---
Made by [Open
SWE](https://openswe.vercel.app/agents/a8b54b7c-cc2f-e6cc-a034-61a8578b8a04)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Fixed `/goal` criteria being discarded when clearing the completed
criteria request from the thread failed.
---
Follow-up to #4784. When a YOLO `/goal` criteria run succeeds, cleanup
clears the `goal_criteria_request` marker before syncing but ignored a
failed clear (checkpoint write failure). A stale marker still naming the
just-completed request then made the sync
(`_sync_goal_rubric_state_from_thread`) and restore
(`_restore_goal_rubric_state`) paths strip the freshly generated
`_pending_goal_*` payload, so no review/YOLO acceptance mounted and the
criteria were silently lost. The marker now supersedes a proposal only
when it names a *different* request than the pending proposal's request
id.
Made by [Open
SWE](https://openswe.vercel.app/agents/6f2018c7-ffa3-ac12-4dab-8eed1142e4c4)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Reduce noisy full-traceback DEBUG logs when an MCP server is skipped
because it requires authentication; the actionable warning and a concise
debug line remain.
---
When an MCP server is skipped during discovery because it needs
authentication — either a token-refresh (`reauth`) failure or an RFC
9728 `401` OAuth challenge — `deepagents-code` logged the entire anyio
`ExceptionGroup` / httpx traceback at DEBUG via `exc_info`, on top of
the actionable WARNING. For these already-classified, expected outcomes
the traceback adds no diagnostic value and just floods debug output.
These two recognized branches now emit a concise single-line DEBUG
breadcrumb (the exception class name only). The full traceback is still
logged for genuinely unknown discovery errors (the `else` branch) and
for classifier failures, so real anomalies stay debuggable. The
user-facing WARNING is unchanged apart from dropping the now-inaccurate
"the original error is in debug logs" note from the reauth message.
Made by [Open
SWE](https://openswe.vercel.app/agents/a5ab799b-1747-0d65-16b6-ee0ccccee0c4)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
A long `task` tool description is rendered on a dim line truncated at
120 characters, but the full text was previously unreachable. This makes
the truncated preview expandable: clicking the description region or
pressing Ctrl+O toggles between the truncated and full description,
mirroring the collapsible command/code affordance on `execute`/`js_eval`
rows.
---
The `task` description now owns Ctrl+O when it is truncated (like an
expandable command/code block), while any expandable tool output stays
reachable by clicking its own region. A "click or Ctrl+O to
expand/collapse" hint is shown beside a truncated description.
<details>
<summary>Test plan</summary>
- Added `TestToolCallMessageTaskDescription` covering expandability
detection, the toggle swap, and click routing.
- Added an app-level Ctrl+O routing test that prefers a truncated `task`
description over expandable output.
- Updated existing Ctrl+O routing tests to account for the new
higher-priority branch.
</details>
Made by [Open
SWE](https://openswe.vercel.app/agents/f5d64d3e-e6e2-d1cf-f52c-0ecbd8829ef4)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
In the installed plugin details view, the `Status: ✓ Enabled` line was
rendered `dim` like every other status line. This styles it with the
`$success` theme color so a successful load reads as green, matching the
semantic coloring used elsewhere in the TUI. Other status lines
(error/disabled/pending, and the secondary MCP restart note) stay `dim`.
Made by [Open
SWE](https://openswe.vercel.app/agents/d3174852-cfc9-43f5-f431-56993468deaf)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Fixed the `dcode` chat input deleting a collapsed `[Pasted text #N]` (or
`[image N]`) placeholder when backspacing the line break on the line
below it; the line break is now removed while the placeholder is
preserved.
---
In the `dcode` chat input, pasting large text collapses it into a
`[Pasted text #N]` placeholder. Pressing Enter to add a newline and then
backspacing from the start of that new line deleted the entire
placeholder instead of just rejoining the lines.
The cause is in `_find_placeholder_span`: its backwards-delete branch
treats any whitespace immediately after a placeholder as an
auto-inserted trailing separator and swallows the whole token with it.
Since `str.isspace()` also matches a newline, backspacing a line break
below a placeholder removed the placeholder. Restricting that branch to
a literal space (the separator actually auto-inserted after media
placeholders) lets a newline fall through to the default backspace,
which removes only the line break and leaves the cursor at the end of
the placeholder line. The same fix is applied to the shared base text
area used by the inline prompts.
Made by [Open
SWE](https://openswe.vercel.app/agents/79b11ee1-f326-668a-e659-c990811f4e29)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
`ls` and `write_todos` results in the `deepagents-code` TUI now align
flush under the output-gutter glyph, matching other tools, instead of
being indented an extra four spaces.
---
The `ls` and `write_todos` renderers in the terminal UI prefixed every
row with four hardcoded spaces, so their entries rendered at a 4-space
hanging indent under the `⎿` output-gutter glyph. Every other tool
formatter (`grep`, `glob`, `read_file`, `execute`) sits flush after that
gutter, and the gutter layout already owns alignment for soft-wrapped
lines — so the extra pad just produced an inconsistent gap between the
glyph and the first item. This emits bare rows for both formatters and
also drops the matching indent from the todo stats header and
empty-state, so the whole block stays flush and consistent. The todo
continuation-line hang-indent auto-adjusts since it derives from the
status-label width.
Made by [Open
SWE](https://openswe.vercel.app/agents/c5dec078-214f-79a6-2417-4b0014e0944e)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Deep Agents Code now emits a `DEBUG` log when a higher-precedence skill
overrides another skill with the same name, aiding skill-resolution
debugging.
---
Skill sources (built-in, plugin, global, project) are merged by
precedence and a higher-precedence skill silently replaces a
lower-precedence one with the same name. This override is intentional
and unchanged; this PR makes it diagnosable by routing both
skill-discovery merge points — the CLI `skills list` loader
(`skills/load.py`) and the runtime `PluginSkillsMiddleware` — through a
shared `merge_skill` helper that emits a `DEBUG` log on each effective
replacement, recording the skill name plus the previous and replacement
source paths and labels.
Made by [Open
SWE](https://openswe.vercel.app/agents/5f97f80c-bed1-0fa5-d0b1-ce67060df37c)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
When an Ollama daemon is down, discovery no longer probes it twice or
emits duplicate, out-of-order debug logs at startup — it probes and logs
"not detected" once per reload.
---
Ollama discovery runs from two startup callers — `get_available_models`
and `get_model_profiles` — that both call
`_get_ollama_installed_models`. Empty results were never cached, so an
unreachable daemon was probed twice per reload and logged `Ollama daemon
not detected ...` twice. Because the second `not detected` (from
`get_model_profiles`) landed right after the first pass's `discovery
returned no models` line, the two appeared out of order even though each
individual pass logs in the correct order.
This tracks endpoints that fail the TCP presence preflight in
`_ollama_unreachable_endpoints` and negatively-caches their empty
result, so the probe and log happen once. A *reachable* daemon that
simply reports no models is still left uncached, preserving recovery of
a later `ollama pull` without `/reload` (covered by the existing
`test_empty_installed_model_discovery_not_cached`).
Made by [Open
SWE](https://openswe.vercel.app/agents/7b64e449-2a7e-f258-17a1-5ffe933608a3)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Fix the live tool-group progress line in `dcode` so it counts only the
tools still running instead of every tool in the step.
---
The collapsed tool-group summary's live progress line summarizes the
whole assistant step instead of what is actually still running. Because
it aggregates every tool in the group, finished calls keep being
reported as in progress — e.g. it shows `Running 1 shell command,
running 2 agents…` even after the shell command and one of the agents
have completed.
This builds the present-tense line from only the still-pending members,
so finished calls drop out as they complete. The past-tense line (shown
once everything finishes) continues to summarize every tool that ran.
The cached present phrasing now rebuilds whenever the set of running
members changes, not just when the group grows.
Made by [Open
SWE](https://openswe.vercel.app/agents/25ed04be-b8ed-97c9-a600-d24d80c02162)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Clearing the Debug Console (`Ctrl+\`) traceback/log tail with `Ctrl+L`
now persists across closing and reopening the console for the process
lifetime, instead of re-populating from the in-memory buffer on the next
open.
---
The console modal is recreated fresh on every open and, on mount,
replays everything still retained in the always-on in-memory ring
buffer. `Ctrl+L` (`action_clear_view`) was deliberately a view-only
clear that advanced only the current instance's render cursor, so
closing and reopening replayed the buffer and the "cleared" records came
back.
This adds a process-lifetime "cleared upto" cursor owned by the app.
`DebugConsoleScreen` gains keyword-only `cleared_upto` (seeds its render
cursor so a prior clear is honored on open) and `on_clear` (reports the
new cursor when `Ctrl+L` fires). `DeepAgentsApp` stores the cursor in
`_debug_console_cleared_upto`, seeds each new console from it, and
persists updates via the callback.
The change stays strictly view-only: the shared ring buffer is never
mutated, other diagnostics are unaffected, and records logged *after* a
clear still appear. Clearing is by emission time, matching the existing
in-session semantics.
Made by [Open
SWE](https://openswe.vercel.app/agents/58c9cc66-afbe-b468-729d-375b731bbf71)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
`/version` output (and incognito shell output) is now selectable and
copyable.
---
The output from the `/version` command could not be selected or copied.
Those tables — and incognito shell output — render through
`AppMessage(markdown=True)`, which produced a raw Rich renderable.
Textual only supports text selection over `Content`/`Text` visuals, so a
`RichVisual` carries none of the per-cell offset metadata selection
relies on and its text is neither highlightable nor copyable.
This renders the muted markdown to segments and rebuilds it as
`Content`, laid out to the widget's current width, so the
tables/rules/emphasis look the same but the text is now selectable and
copyable. Trailing padding is trimmed per line so copies stay clean.
Made by [Open
SWE](https://openswe.vercel.app/agents/f705adb2-3ebb-25a2-7ebd-ddce94887917)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
`/version` now lists `langchain-quickjs` under its "Core dependencies"
section for editable installs.
---
`langchain-quickjs` powers the built-in interpreter and is a core
runtime dependency (declared directly in `dependencies`, not as an
optional extra). It was previously invisible in `/version`: the
"Installed optional dependencies" table only reads packages gated by
`extra == "..."` markers (and the `quickjs` extra is intentionally
empty), while the curated `CORE_DEPENDENCIES` list that drives the "Core
dependencies" section did not include it.
Adding it to `CORE_DEPENDENCIES` surfaces its resolved version alongside
the other LangChain-ecosystem packages, which helps diagnose editable
environments where a local checkout of the partner package may be
overriding the released one. The section is only rendered for editable
installs, matching existing behavior.
The `CORE_DEPENDENCIES`-driven tests iterate the tuple generically, so
they cover the new entry without modification.
Made by [Open
SWE](https://openswe.vercel.app/agents/e258f95b-7cc4-33f3-52f0-32d4aa4c13fd)
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Plugins are now available by default in deepagents-code without setting
`DEEPAGENTS_CODE_EXPERIMENTAL`.
This removes the flag gates from CLI and slash-command discovery, plugin
skills and MCP loading, and reload behavior while preserving the flag
for unrelated experimental features.
Made by [Open
SWE](https://openswe.vercel.app/agents/019f6c79-6211-734f-b05c-a5a3401c8a6b)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Co-authored-by: Mason Daugherty <mason@langchain.dev>
Co-authored-by: Mason Daugherty <github@mdrxy.com>
Fixes MCP OAuth token refresh crashing tool calls under `langgraph dev`
with a `NodeCancelledError`.
---
OAuth refresh previously performed token-file work synchronously.
BlockBuster could interrupt that work, cancel session initialization,
and leave its `AsyncExitStack` to be finalized from another task. Users
then saw errors such as:
Attempted to exit cancel scope in a different task than it was entered
in
Token-file I/O now runs in worker threads. Writes are serialized, token
and expiry values are read from one snapshot, and cancellation waits for
token writes and refresh-lock acquisition or release to finish before
propagating. Partial MCP sessions are closed by the task that created
them without hiding the original failure.
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Typing "reconnect" or "connect" in the slash-command autocomplete now
surfaces the `/restart` command, which respawns the agent server.
Adds `reconnect` and `connect` to the `hidden_keywords` for the
`/restart` `SlashCommand` entry so fuzzy matching finds it under those
common terms. These keywords are never displayed and don't appear in the
commands catalog, so no regeneration is needed.
Made by [Open
SWE](https://openswe.vercel.app/agents/05f60126-f5ea-25a4-3b3b-84127a4a529b)
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Raise the minimum supported `langchain-quickjs` version to `0.3.3` in
Deep Agents Code, the SDK quickjs extra, and evals now that the release
is available on PyPI.
Refresh the corresponding lockfiles, including the `langchain` and
`langgraph` versions required by `langchain-quickjs==0.3.3`.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/langchain-ai/deepagents/network/alerts).
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Debug Console (`Ctrl+\`) thread ID is now click-to-copy and shows a
clickable `(langsmith)` trace link.
---
The in-app Debug Console (`Ctrl+\`) now lets you click the Thread ID
snapshot row to copy it to the clipboard, and appends a clickable inline
`(langsmith)` trace link next to it once the thread's LangSmith URL
resolves. The URL lookup runs in a background worker with a short
timeout (mirroring the welcome banner), so it never blocks opening the
overlay and degrades to no link on failure.
Made by [Open
SWE](https://openswe.vercel.app/agents/7f7451e4-5850-04d6-b76e-ef6dea6300a4)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Auto-approve ("YOLO") runs are now labeled with
`dcode_auto_approve=True` in LangSmith trace metadata, making them
filterable.
---
Auto-approve ("YOLO") mode — the `Shift+Tab` toggle / `--auto-approve` —
sets `interrupt_on = {}` so tools run with no HITL gate, but nothing
recorded that state in LangSmith traces, so YOLO runs weren't
filterable. The `coding-agent-v1` contract's `approval_policy` key can't
help here: it's scoped to root/interrupted runs and would leak onto
every descendant run (and fail contract validation) if stamped
trace-wide.
This adds a non-contract diagnostic `dcode_auto_approve=True` metadata
key in `build_stream_config`, mirroring the existing
`dcode_experimental` pattern (only stamped when active). Interactive
turns pass `session_state.auto_approve`; headless turns pass the
resolved `use_auto_approve` (which reflects "tools run without HITL
because shell is unrestricted or disabled" — the same `auto_approve`
flag the graph consumes). Metadata is sampled once at turn start, so a
mid-turn toggle doesn't relabel that turn's trace.
New keyword-only `auto_approve` param defaults to `False`, so the change
is additive and backward-compatible.
Made by [Open
SWE](https://openswe.vercel.app/agents/31881cb9-2c33-7505-1b1a-fd453e84ea5a)
## References
- Plan:
https://openswe.vercel.app/agents/31881cb9-2c33-7505-1b1a-fd453e84ea5a/plan
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Make the Deep Agents Code unit tests hermetic so they no longer depend
on the developer's real environment, `~/.deepagents/.env`, or the
checkout-path length.
Ambient MCP trust vars
(`DEEPAGENTS_CODE_DANGEROUSLY_ENABLE_PROJECT_MCP_SERVERS` and friends),
`DEEPAGENTS_CODE_DEBUG_NOTIFICATIONS`, and
`DEEPAGENTS_CODE_EXPERIMENTAL` can be loaded from the developer's global
dotenv at `deepagents_code.config` import time — before fixtures run —
and `/reload` rereads that global dotenv and restores them. The
dangerous MCP allowlist intentionally replaces scoped TOML approvals
(breaking trust-list/selective-project-trust assertions), the debug var
changes notification suppression, and a restored experimental flag
breaks the `/reload` plugin-summary test. Separately,
`TestBranchDisplay::test_short_branch_name_not_truncated` let a long
real CWD consume the status bar, leaving the branch widget zero width.
Approach (test-only; no production behavior changes):
- New autouse fixture redirects `config._GLOBAL_DOTENV_PATH` to a
nonexistent `tmp_path` file so dotenv rereads (e.g. `/reload`) are
inert.
- New autouse fixture clears `DEEPAGENTS_CODE_DEBUG_NOTIFICATIONS`; the
existing MCP-trust fixture already removes the trust vars (docstring
expanded to explain why).
- The short-branch test now hides the CWD via `HIDE_CWD`, consistent
with neighboring branch-display tests, so path length can't starve the
widget.
Tests that intentionally exercise dotenv loading already set
`_GLOBAL_DOTENV_PATH` and their inputs explicitly in the test body
(after the isolation fixtures), so they are unaffected.
Made by [Open
SWE](https://openswe.vercel.app/agents/234e9ee9-f18a-e812-4187-aae8190e4711)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
The splash tip above the chat input is now dismissed when the TUI is
launched with an initial prompt (`-m`), skill (`--skill`), or goal
(`--goal`), matching interactive submissions.
---
When launching the TUI with `dcode -m "msg"`, the splash tip above the
chat input stayed visible, unlike a normal interactive prompt which
clears it.
The tip was only dismissed inside `_submit_input`, the shared path for
interactive and external prompts. Startup submissions from `-m` (as well
as `--skill` and `--goal`) run through `_submit_initial_submission`
instead, which dispatches directly to `_handle_user_message` /
`_invoke_skill` / `_handle_goal_command` and never dismissed the tip.
This adds a `_dismiss_startup_tip()` call at the top of
`_submit_initial_submission` so all startup submission paths match
interactive behavior.
Made by [Open
SWE](https://openswe.vercel.app/agents/2d2a8fdc-c71c-58c6-287a-6d4109d24bbb)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
## Description
Marketplace detail controls ignored Tab and Shift+Tab because those
bindings only attempted to switch tabs. Cycle enabled detail options
with wraparound while preserving existing list-tab and Escape behavior.
## Release Note
Marketplace detail controls now support visible, predictable Tab and
Shift+Tab keyboard navigation.
## Test Plan
- [x] Navigate marketplace details forward, backward, and through
wraparound with a Textual pilot test.
Made by [Open
SWE](https://openswe.vercel.app/agents/019f6783-f3db-727b-ad05-65934c0a9505)
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Closes
[DCD-49](https://linear.app/langchain/issue/DCD-49/plugins-fix-installed-component-discovery-and-status-messaging)
Plugin manager status and component messaging now reflect what
deepagents-code actually loads, and Enabled only appears after
`/reload`.
---
Plugins that only ship `agents/`/`commands/`/`hooks` (e.g.
`pr-review-toolkit`) now report those as unsupported instead of “no
components discovered.” Discover preview and installed status
distinguish pending `/reload`, enabled, and error.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Mason Daugherty <github@mdrxy.com>
Co-authored-by: Mason Daugherty <mason@langchain.dev>
Closes
[DCD-48](https://linear.app/langchain/issue/DCD-48/plugins-improve-empty-marketplace-onboarding-and-list-polish)
`/plugins` empty Discover state now links straight to adding a
marketplace, with clearer marketplace error and enabled-status styling.
---
Make `/plugins` easier to onboard and a bit clearer to scan:
- empty Discover state offers a direct Add marketplace action
- marketplaces list gets a divider and styled load-error labels
- plugin rows use per-chip styling; enabled stays bold on highlight and
`$success` in details
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Mason Daugherty <github@mdrxy.com>
`filelock` 3.30.0 runs a blocking temp-directory probe
(`_probe_link_follow_symlinks`) at import time. `deepagents-code`
imports `filelock` (via `mcp_auth`) on the async server-graph startup
path, so Blockbuster rejects the resulting `os.getcwd` call and the
graph fails its readiness check with `BlockingError: Blocking call to
os.getcwd`, aborting startup entirely. The broad `>=3.12,<4.0.0` range
let a fresh install resolve the just-released 3.30.0, which is why even
downgrading `deepagents-code` reproduced it.
Capping at `<3.30` keeps resolution on 3.29.x. A follow-up can make the
`filelock` import loop-safe (e.g. warm it up off the event loop) and
relax the cap.
## Release Note
Fix `deepagents-code` startup failure (`BlockingError: Blocking call to
os.getcwd`) caused by `filelock` 3.30.0.
## Test Plan
- [ ] `dcode` launches cleanly with `filelock` resolved to 3.29.x
Made by [Open
SWE](https://openswe.vercel.app/agents/a27d2d36-4e59-b0b2-edbb-228bc6e557c9)
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
YOLO mode now automatically accepts successfully generated `/goal`
acceptance criteria, including amendments, regenerated proposals, and
proposals restored from a thread.
---
When someone creates, amends, or regenerates a `/goal` while YOLO mode
is enabled, dcode still generates acceptance criteria but now accepts a
successful proposal without interrupting the workflow with an
interactive review.
Automatic acceptance reads the live per-thread approval mode and follows
the same persistence and continuation path as selecting “Accept proposed
criteria.” Turning YOLO on also resolves a proposal already awaiting
review, while turning it off before generation finishes preserves the
manual review. Failed, cancelled, rejected, stale, and superseded
proposals remain fail-closed, and review widgets, futures, tasks, and
focus are cleaned up when automatic acceptance takes over.
Manual goal review and standalone `/rubric` behavior are unchanged. The
transcript explains when YOLO accepted criteria automatically, and
`/goal show` continues to expose the accepted objective and criteria.
Accepted `/goal` objectives now automatically transition to `complete`
when their current goal-backed work turn finishes with a satisfied
acceptance-criteria grade. Completed goals remain visible through `/goal
show` but no longer affect later ordinary turns.
---
An accepted `/goal` should finish when its own final rubric grade says
every criterion is satisfied. Previously the agent also had to call
`update_goal(status="complete", ...)`, manual mode requested another
approval, and successful completion removed the goal record entirely.
That made completion depend on approval mode and left `/goal show` with
nothing to report.
Completion now requires a validated grading event observed live during
the current goal-backed work turn, a matching grading-run identifier in
the checkpoint, and a turn that finishes without aborting. Criteria
generation, thread restoration, standalone `/rubric` grading, unrelated
or ungraded turns, stale persisted grader state, and unknown grader
verdicts cannot complete a goal. If a satisfied grade arrives before an
interrupted turn, the goal remains active and the UI explains that it
will be checked again on the next turn.
Completion is persisted transactionally; if that write fails, the active
goal and any agent-provided note remain available for a later retry.
Completed goals retain their objective, acceptance criteria, status, and
completion note while no longer driving subsequent work or grading.
Agents may still call `update_goal(status="complete", ...)` to provide a
completion note, but the call is optional. Manual and YOLO modes use the
same completion path without a completion approval prompt.
`Ctrl+X` now opens the active `/goal` criteria or rejection-feedback
field in the configured external editor.
---
When a user was editing proposed goal criteria or entering regeneration
feedback, `Ctrl+X` still opened the unrelated chat draft because the
priority app binding always targeted the composer. This moved focus out
of the review and made external-editor composition unusable in both
goal-review modes.
`Ctrl+X` now detects the active goal-review field and opens its complete
logical value, including expanded collapsed-paste content, in `$VISUAL`
or `$EDITOR`. Saved text returns to the same field without submitting;
cancellation or failure preserves the existing value and focus. Hidden,
stale, detached, or unfocused goal editors fall through to the unchanged
chat-input behavior.
`/goal` acceptance-criteria drafting now runs on the agent server and
can use conversation, repository, web, and explicitly read-only
configured MCP context while preserving resumable review state.
---
Previously, `/goal` proposals were drafted in the client process from
the explicit objective, so remote or sandbox repository context and
references to the current conversation were unavailable. This moves
proposal and amendment drafting into a nested agent in the main server
graph, where it can use recent conversation context, bounded read-only
repository search, `fetch_url`, optional web search, and configured MCP
tools explicitly annotated as read-only.
Repository context remains read-only and repository-rooted across
backends: local reads use a virtual project root, while sandbox reads
are constrained to the provider's declared working directory, including
canonical-path checks that reject symlink escapes.
Proposals are stored as pending checkpoint state rather than chat
messages, so review survives remote interrupts and resumes without
polluting the coding conversation. Each proposal is correlated with its
originating request, and criteria requests are cleared after success,
failure, or cancellation without clearing newer requests. Cancelling
criteria generation stops the server run without adding normal
chat-interruption messages. The client refreshes checkpoint state after
generation and reuses the existing accept, edit, and reject flow; model
profile overrides now cross the client/server boundary consistently.
Deleting a thread now also removes its offloaded conversation history
from `~/.deepagents`.
---
Deleting a thread through the `/threads` switcher (and the `threads
delete` CLI) only removed the thread's SQLite checkpoints, leaving its
offloaded conversation-history archive orphaned under
`~/.deepagents/conversation_history/{thread_id}.md`. Over time these
files accumulate for threads the user believes are gone.
`delete_thread` now also removes the per-thread archive via a new
`delete_offloaded_history` helper in `offload.py`, which resolves the
same offload root used when writing history. The helper guards against a
crafted `thread_id` escaping the archive directory and is a no-op when
no archive exists (e.g. server/sandbox mode, where history lives on the
sandbox backend).
Made by [Open
SWE](https://openswe.vercel.app/agents/1ca83aca-3d44-5887-c9c2-3ea96c440136)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Fixed the `/mcp` viewer Ctrl+R reconnect blocking keyboard input until
the server finished reconnecting.
---
Pressing Ctrl+R inside the `/mcp` viewer to reconnect froze the chat
input until the reconnect finished. The handler scheduled
`_reconnect_from_viewer_safe` with `call_later`, which awaits the
coroutine inside the Textual app message pump; the multi-second
`server_proc.restart()` then stalled the pump so key events were no
longer forwarded. Running the reconnect as a detached
`asyncio.create_task` (mirroring the force-reconnect confirm path) keeps
the pump free, so input stays responsive and typed messages queue and
drain once the server is ready.
Made by [Open
SWE](https://openswe.vercel.app/agents/b1d98f23-e279-dc41-4f4f-ce0818900274)
---------
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
`test_cli_agent_summarizes` exercises the production local
conversation-history backend, whose fallback location is the user's
`~/.deepagents` directory. The test's generated 720 KB payload therefore
survived each run and polluted real user state.
Patch the test helper's offload root to a directory under `tmp_path` and
assert that the archive is created there. Pytest now removes the
artifact with the rest of the test directory without changing production
persistence behavior.
Verified with the full `test_end_to_end.py` unit test file, Ruff, and a
before/after comparison confirming the real conversation-history
directory remains unchanged.
Updates the deepagents-code sandbox integration suite to match the
current `write()` contract: writing to an existing file replaces its
contents rather than returning an error. This keeps the Python test
expectation aligned with the overwrite behavior covered by the
corresponding deepagentsjs standard tests.
## Changes
- Rename the existing-file write test to describe overwrite behavior.
- Assert that the second write succeeds and that the replacement content
is persisted.
- Update the sandbox operations module overview to include overwriting
existing files.
`dcode` now surfaces the tool calls that require approval instead of
hiding them in a collapsed group.
---
Approval-blocked tool calls could remain hidden inside the collapsed
live group, leaving only a generic batch prompt. Finalize the active
group at the approval boundary and detach pending rows while preserving
single-command duplicate suppression.
Made by [Open
SWE](https://openswe.vercel.app/agents/3f2b94f6-67ee-d5d4-d2a5-250adeacac5e)
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
github-actions[bot]